A company has recently failed a security audit.

The correct answer is A — Expiration.

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), password expiration policies require users to change their passwords after a certain period, ensuring that long-term credential exposure risk is minimized.

Length (B) defines minimum password size. Recovery (C) relates to resetting forgotten passwords. Complexity (D) enforces character requirements, not age.

Reference Extract from Study Guide:

"Password expiration policies require users to update passwords regularly, minimizing the risk of long-term credential exposure."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Password Security Best Practices

=============================================